EC-COUNCIL 212-89 Online Practice Questions and Exam Preparation

EC-COUNCIL 212-89 Online Questions & Answers

• Question 201:

  Jason is setting up a computer forensics lab and must perform the following steps: 1. physical location and structural design considerations; 2. planning and budgeting; 3. work area considerations; 4. physical security recommendations; 5. forensic lab licensing; 6. human resource considerations. Arrange these steps in the order of execution.

  A. 2 -> 1 -> 3 -> 6 -> 4 -> 5
  B. 2->3->l ->4->6->5
  C. 5-> 2-> l-> 3-> 4-> 6
  D. 3 .> 2 -> 1 -> 4-> 6-> 5
  A. 2 -> 1 -> 3 -> 6 -> 4 -> 5

  ---

  Setting up a computer forensics lab involves several critical steps that need to be executed in a logical and efficient order. The correct sequence starts with planning and budgeting (2), as it is essential to understand the scope, resources, and financial commitment required for the lab. The next step involves considering the physical location and structural design (1) to ensure the lab meets operational needs and security requirements. Work area considerations (3) follow, focusing on the layout and functionality of the workspace. Human resource considerations (6) are crucial next, to ensure the lab is staffed with qualified personnel. Physical security recommendations (4) are then implemented to protect the lab and its resources. Finally, forensic lab licensing (5) ensures the lab operates within legal and regulatory frameworks.

  References: The ECIH v3 course materials from EC-Council outline the foundational steps for setting up a computer forensics lab, stressing the importance of thorough planning and adherence to best practices in lab design and operation.

• Question 202:

  Which of the following is a volatile evidence collecting tool?

  A. Netstat
  B. HashTool
  C. FTK Images
  D. ProDiscover Forensics
  A. Netstat

  ---

  Netstat (network statistics) is a command-line tool that displays network connections (both incoming and outgoing), routing tables, and a number of network interface (and network protocol) statistics. It is considered a volatile evidence collecting tool because it gathers information that exists in the system's memory, which is lost upon shutdown or reboot. This makes it invaluable for collecting evidence of active connections and processes that are present at the time of the incident response but does not persistently store data that can be recovered later. This contrasts with tools like FTK Imager or ProDiscover Forensics, which are used for acquiring digital evidence in a non-volatile manner, such as disk imaging, and HashTool, which is used for validating the integrity of collected digital evidence through hashing.

  References: EC-Council's ECIH v3 materials include discussions on the importance of volatile and non- volatile evidence, emphasizing tools like Netstat for their role in the immediate collection

• Question 203:

  Rinni is an incident handler and she is performing memory dump analysis. Which of following tools she can use in order to perform memory dump analysis?

  A. OllyDbg and IDA Pro
  B. Scylla and OllyDumpEx
  C. Procmon and ProcessExplorer
  D. iNetSim
  A. OllyDbg and IDA Pro

  ---

  For memory dump analysis, tools like Scylla and OllyDumpEx are more suited. These tools are designed to analyze and extract information from memory dumps, which can be crucial for understanding the state of a system at the time of an incident. Scylla is used for reconstructing imports in dumped binaries, while OllyDumpEx is an OllyDbg plugin used for dumping process memory. Both tools are valuable for incident handlers like Rinni who are performing memory dump analysis to uncover evidence or understand the behavior of malicious software.

• Question 204:

  Which of the following is not the responsibility of first responders?

  A. Protecting the crime scene
  B. Identifying the crime scene
  C. Packaging and transporting the electronic evidence
  D. Preserving temporary and fragile evidence and then shut down or reboot the victim's computer
  B. Identifying the crime scene

  ---

  The responsibility of first responders does not include shutting down or rebooting the victim's computer as a measure to preserve temporary and fragile evidence. In fact, such actions can potentially alter or destroy volatile data that could be crucial for the investigation. The primary responsibilities of first responders include protecting and identifying the crime scene, and ensuring the preservation of evidence in its original state as much as possible, which may involve isolating affected systems from the network but not necessarily shutting them down or rebooting them without proper forensic readiness and consideration.

• Question 205:

  What is the best staffing model for an incident response team if current employees' expertise is very low?

  A. Fully outsourced
  B. Partially outsourced
  C. Fully insourced
  D. All the above
  A. Fully outsourced

  ---

  Explanation

• Question 206:

  Malicious Micky has moved from the delivery stage to the exploitation stage of the kill chain. This malware wants to find and report to the command center any useful services on the system. Which of the following recon attacks is the MOST LIKELY to provide this information?

  A. IP range sweep
  B. Packet sniffing
  C. Session hijack
  D. Port scan
  D. Port scan

  ---

  When malware moves from the delivery stage to the exploitation stage in the cyber kill chain, its objective often shifts to identifying exploitable vulnerabilities within the targeted system. A port scan is a technique used to discover services that are listening on ports within a system. By scanning the system's ports, the malware can identify open ports and the services running on them, providing valuable information about potential entry points for further exploitation. This type of reconnaissance attack is aimed at

  gathering intelligence on the target system's network services, which can then be reported back to a command and control center for further malicious activity planning.

  Port scanning is more relevant than IP range sweeps, packet sniffing, or session hijacking for identifying useful services on a system because it directly targets the discovery of accessible network services and their corresponding ports. While the other methods can also be part of the reconnaissance phase, they serve different purposes: IP range sweeps aim to identify active IP addresses, packet sniffing intercepts data packets to gather information, and session hijacking involves taking over a valid user

  session. In contrast, port scanning is specifically designed to enumerate services that could be exploited.

  References: The ECIH v3 certification materials discuss various reconnaissance techniques used by attackers, including port scanning, as part of the exploitation stage of the kill chain. Understanding these techniques is crucial for incident handlers in identifying how attackers gather information and plan their attacks.

• Question 207:

  The service organization that provides 24x7 computer security incident response services to any user, company, government agency, or organization is known as:

  A. Computer Security Incident Response Team CSIRT
  B. Security Operations Center SOC
  C. Digital Forensics Examiner
  D. Vulnerability Assessor
  A. Computer Security Incident Response Team CSIRT

  ---

  Explanation

• Question 208:

  Identify Sarbanes-Oxley Act (SOX) Title, which consists of only one section, that includes measures designed to help restore investor confidence in the reporting of securities analysts.

  A. Title VIII: Corporate and Criminal Fraud Accountability
  B. Title V: Analyst Conflicts of Interest
  C. Title VII: Studies and Reports
  D. Title IX: White-Collar-Crime Penalty Enhancement
  B. Title V: Analyst Conflicts of Interest

  ---

  The Sarbanes-Oxley Act (SOX) Title V, titled "Analyst Conflicts of Interest," contains measures specifically designed to restore investor confidence in the reporting of securities analysts. It addresses the issue of potential conflicts of interest for securities analysts who recommend stocks and other securities by requiring disclosure of certain relationships and financial interests between analysts and the companies they cover. This part of the SOX Act aims to ensure that investors receive unbiased and accurate information from analysts, thereby helping to restore trust in financial markets. Title V consists of only one section, making it unique compared to other titles within the Act that may encompass multiple sections or provisions.

  References: The Incident Handler (ECIH v3) certification materials might not directly cover the specifics of the Sarbanes-Oxley Act but would underscore the importance of understanding regulatory requirements and compliance, especially in roles involving incident response and information security governance.

• Question 209:

  Jason is an incident handler dealing with malware incidents. He was asked to perform memory dump analysis in order to collect the information about the basic functionality of any program. As a part of his assignment, he needs to perform string search analysis to search for the malicious string that could determine harmful actions that a program can perform. Which of the following string-searching tools Jason needs to use to do the intended task?

  A. PEView
  B. BinText
  C. Dependency Walker
  D. Process Explorer
  B. BinText

  ---

  BinText is a lightweight text extraction tool that can be used to perform string search analysis within binary files. This functionality is crucial for incident handlers like Jason, who are tasked with analyzing memory dumps for malicious activity or indicators of compromise. By searching for specific strings or patterns that are known to be associated with malware, BinText helps in identifying potentially harmful actions that a program could perform, thus aiding in the investigation of malware incidents.

  References: Memory dump analysis and string search techniques are important skills covered in the ECIH v3 curriculum, emphasizing the use of tools like BinText to aid in the forensic analysis of malware-infected systems.

• Question 210:

  An access control policy authorized a group of users to perform a set of actions on a set of resources. Access to resources is based on necessity and if a particular job role requires the use of those resources. Which of the following is NOT a fundamental element of access control policy

  A. Action group: group of actions performed by the users on resources
  B. Development group: group of persons who develop the policy
  C. Resource group: resources controlled by the policy
  D. Access group: group of users to which the policy applies
  B. Development group: group of persons who develop the policy

  ---

  Explanation